CVE-2020-7740

Katalog CVE

CVSS 8.2 · High EPSS 2,0%

Kerentanan Improper Input Validation pada node-pdf-generator project node-pdf-generator. Skor CVSS 3.1 8.2 (High) menurut snyk.io.

Deskripsi (NVD)

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.

Rincian

Terbit di NVD

6 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber snyk.io
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/darrenhaken/node-pdf-generator/blob/master/index.js%23L29 broken link · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636 advisory pihak ketiga